CVE-2026-79996 User Registration & Membership < 5.2.6 - Authenticated Privilege Escalation via Login Settings

The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator...

CVE-2026-12514

The Shared Files WordPress plugin (versions before 1.7.67 ) and shared-files-pro (versions before 1.7.70 ) contain an unauthenticated limited file upload vulnerability. The root cause is a missing capability check in the file-upload handler, which is accessible to unauthenticated users and only p...

EUVD-2026-67566

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on public pages, so an unauthenticated visito...

SUSE CVE-2026-72061

In the Linux kernel, the following vulnerability has been resolved: net: sit: require CAPNETADMIN in the device netns for changelink ipip6changelink operates on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other than t...

SUSE CVE-2026-75803

Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVPCipher function. Impact summary: Applications calling EVPCipher on an empty ciphertext and...

EUVD-2026-67323

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them...

PT-2026-83009

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390/zcrypt component regarding incorrect domain value verification when processing an EP11 CPRB Crypto Parameter Record Block for transmission to a crypto card...

CVE-2026-82267: Missing Authorization

Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...

PT-2026-82948

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the spacemit pin set config function where the code performs a NULL check on the wrong variable. The function uses spacemit get pin to retrieve a per-pin descriptor bu...

CVE-2026-79996: Improper Privilege Management

The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator...

CVE-2026-80609: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: qede: fix out-of-bounds check for cqe-lenlist Move index check before element access...

PT-2026-82909

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the qede driver where an out-of-bounds check for the cqe-len list array is performed incorrectly. The flaw is addressed by moving the index check to occur before the...

PT-2026-82975

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the libbpf signed loader where it fails to ensure that metadata maps are exclusive. The loader verifies map-sha against the metadata hash using BPF OBJ GET INFO BY FD ...

PT-2026-83010

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390/dasd component where the fmt buffer size variable in the dasd eckd check device format function is declared as an int. When calculating the buffer size using...

PT-2026-86735

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix undersized format-check buffer fmt buffer size in dasd eckd check device format is declared as int, even though one of the multiplicands, sizeofstruct eckd count, is a size t. The expression trkcount rpt max...

CVE-2026-80624: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mfd: cs42l43: Sanity check firmware size Currently the code checks if a firmware was received, however it does not verify that the firmware size is larger than the firmware header. As the firmware pointer is dereferenced as a...

PT-2026-82924

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cs42l43 multi-function device mfd driver where the system fails to verify if the received firmware size is larger than the firmware header. Because the firmware...

PT-2026-83049

Name of the Vulnerable Software and Affected Versions Eclipse Lyo versions 2.0.0 through 7.0.0 Description OAuth server authorization checks can be bypassed when the server supports 2-legged authentication. Applications utilizing the AbstractAdapterCredentialsFilter for authorization filters are...

PT-2026-83350

Name of the Vulnerable Software and Affected Versions Graylog versions prior to 6.3.12 Graylog versions prior to 7.0.7 Graylog versions prior to 7.1.2 Description An insecure direct object reference IDOR exists in the token revocation process. An authenticated user can delete access tokens...

PT-2026-82941

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the wlcore wifi driver where the firmware version check for IGTK Integrity Group Temporal Key causes the number of available ciphers to decrease upon every boot when...